Re: Is ttsh still OK?

From: Ben Webb (ben@bellatrix.pcl.ox.ac.uk)
Date: 12/20/02 

From: Ben Webb <ben@bellatrix.pcl.ox.ac.uk>
Date: Fri, 20 Dec 2002 11:57:12 +0000 (UTC)

On Thu, 19 Dec 2002 20:27:30 +0000 (UTC), Felix Havemann
<blackandwhite.nospam@felixthecat.de> wrote:
> Why should putty be upgraded if you use it as client only?

Because you can be compromised by connecting to a malicious server.

> If you use OpenSSH on your server you should, no: you must upgrade to
> the latest version, at least 3.4p1 (although 3.5 ist out already).

The CERT advisory (CA-2002-36) believes that no version of OpenSSH is
vulnerable. You should, however, be running 3.4 or 3.5 already anyway,
due to the OpenSSH problems that were discovered a few months ago.

        Ben 

-- 
ben@bellatrix.pcl.ox.ac.uk           http://bellatrix.pcl.ox.ac.uk/~ben/
"'In a sense,' he said, 'you're alone here, so if jump you best jump far'"